Re: Attempts to push spam through apache

When a box gets compromised, its a good idea to strip it down.  I think
I saw it termed as "burning it down and paving over it" or something of
that ilk.  I realize that in the real world, that of course is not
always possible ;)

Anyway, my point: A rootkit scan should be a daily cronjob on any DMZ or
public services server.  I personally prefer rkhunter due to the fact
that you can customize output for console or cronjob usage, and its
relatively frequent updating and heuristic scanning.

This of course, should be complimentary to other security measures and
works in tandem with firewall rules, a network IDS, properly configured
servers, and any measure of custom tools (I find that portsentry, when
properly configured for the services running on the server, is a good
one to run on servers as well).

-- 
-----------------
Wayne S. Frazee

On Sun, 2004-08-22 at 03:09, Adrian Popescu wrote:

> use "chkrootkit" tool , or other programs (run it a couple of times).
> Also look in /tmp or other places where Apache (User/Group)
> are able to write and see if there is any trace left.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBBKW5fEDq+CTp0dd0RAlxAAKC1c49vDNTFG1pCYAqgVIlyqcBxBQCfSNPW
1Sg3LxeGL123Y0DT5c1j7O8=
=5G3d
-----END PGP SIGNATURE-----